Cloud Workload Sensors for Runtime Identity Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identity misuse in cloud computing environments poses significant risks, including unauthorized access to sensitive information, cybercrimes, and erosion of trust in digital systems, necessitating robust security measures to mitigate these threats.
Innovation Solution
A system is configured to deploy sensors in cloud workloads to detect runtime processes, inspect code objects for cybersecurity objects, and generate enriched logs associating runtime processes with events, utilizing identity management systems to monitor and manage identities, and store representations in security databases.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If sensors are deployed in cloud workloads to detect runtime processes and generate enriched logs, then detection precision of cybersecurity threats is improved, but device complexity increases
Solution Approach 1:
The system segments the security monitoring function by deploying lightweight sensors within individual cloud workloads rather than using a centralized monitoring system. Each sensor independently detects runtime processes and generates enriched logs for its host workload, dividing the complex monitoring task into multiple simple, distributed components that reduce overall system complexity while improving detection precision through localized observation.
2Reliability
If runtime processes are correlated with identity information through enriched logs, then reliability of security monitoring is improved, but loss of time in data processing increases
Solution Approach 1:
The system performs preliminary action by pre-generating enriched logs that contain correlated runtime process and identity information at the time of events, rather than performing complex correlation queries later during analysis. The sensors capture and enrich log data in real-time as events occur, storing the correlated information in security databases for immediate retrieval, thus improving reliability without significant time loss during incident response.
Data Source
AI summary
A system and method for associating an event in a cloud computing log to a process running on a workload is presented. The method includes: configuring a workload deployed in a cloud computing environment to deploy thereon a sensor, the sensor configured to detect a runtime process on the workload, the runtime process utilizing an identity; detecting in a log of the cloud computing environment an event based on an identifier of the workload, the log including a plurality of events; inspecting a code object for a cybersecurity object, the code object utilized in deploying the workload in the cloud computing environment; associating the runtime process with the event based on an identifier of the workload and the cybersecurity object, wherein the cybersecurity object indicates the identity; and generating an enriched log including an identifier of the runtime process associated with the event and the cybersecurity object.